github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 12:44:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

tmpfs: zero unused folio tail for long symlinks

Browse Source 
shmem_symlink() marks the entire folio uptodate after copying only the
NUL-terminated link target.  The remainder of the freshly allocated folio
is left uninitialized.

Reclaim may pass the whole folio to a swap compressor.  KMSAN observed
sw842_compress() computing a checksum over the uninitialized tail.  If the
folio is written to a swap device, those bytes can also leave the kernel.

Zero the remainder of the folio before marking it uptodate and dirty.

Link: https://lore.kernel.org/20260628004314.27370-1-alhouseenyousef@gmail.com
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: syzbot+bf5586280a66e9ccdfa9@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=bf5586280a66e9ccdfa9
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
This commit is contained in:
Yousef Alhouseen 2026-06-28 02:43:14 +02:00 committed by Andrew Morton
parent efcf17453c
commit 31fd8876a3
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
mm/shmem.c
View File

@ -4067,6 +4067,7 @@ static int shmem_symlink(struct mnt_idmap *idmap, struct inode *dir,
goto out_remove_offset;
inode->i_op = &shmem_symlink_inode_operations;
memcpy(folio_address(folio), symname, len);
folio_zero_range(folio, len, folio_size(folio) - len);
folio_mark_uptodate(folio);
folio_mark_dirty(folio);
folio_unlock(folio);